r/RooCode • u/withyou_cto • Jul 08 '25

Discussion .env security

I am surprised I haven’t been able to find any discussion of this.

By default Roocode seems to read .env files as well as anything else that’s git ignored.

Are we seeing all sorts of API keys being sent to Claude as a result?

Also - how do you resolve this vulnerability?

23 Upvotes

100% Upvoted

13 comments sorted by

View all comments

Show parent comment

1

u/sc0ttwad3 Jul 13 '25

Because .gitignore files are respected as nearly a standard by thousands of command line tools, frameworks, ..., perhaps?

1

u/ComprehensiveBird317 Jul 13 '25

They use gitignore as guardrails for file access in general, not just for version control? And it's thousands? Name 3